Merge 2eddd3b30a into 7e6874ad80

Closes gh-35580

framework-docs/modules/ROOT/pages/core/beans/annotation-config/autowired.adoc

@@ -37,18 +37,18 @@ Kotlin::
 ----
 ======
 
-[NOTE]
+[TIP]
 ====
-As of Spring Framework 4.3, an `@Autowired` annotation on such a constructor is no longer
-necessary if the target bean defines only one constructor to begin with. However, if
-several constructors are available and there is no primary/default constructor, at least
-one of the constructors must be annotated with `@Autowired` in order to instruct the
-container which one to use. See the discussion on
-xref:core/beans/annotation-config/autowired.adoc#beans-autowired-annotation-constructor-resolution[constructor resolution] for details.
+An `@Autowired` annotation on such a constructor is not necessary if the target bean
+defines only one constructor. However, if several constructors are available and there is
+no primary or default constructor, at least one of the constructors must be annotated
+with `@Autowired` in order to instruct the container which one to use. See the discussion
+on xref:core/beans/annotation-config/autowired.adoc#beans-autowired-annotation-constructor-resolution[constructor resolution]
+for details.
 ====
 
-You can also apply the `@Autowired` annotation to _traditional_ setter methods,
-as the following example shows:
+You can apply the `@Autowired` annotation to _traditional_ setter methods, as the
+following example shows:
 
 [tabs]
 ======
@@ -84,8 +84,8 @@ Kotlin::
 ----
 ======
 
-You can also apply the annotation to methods with arbitrary names and multiple
-arguments, as the following example shows:
+You can apply `@Autowired` to methods with arbitrary names and multiple arguments, as the
+following example shows:
 
 [tabs]
 ======
@@ -176,14 +176,15 @@ Kotlin::
 ====
 Make sure that your target components (for example, `MovieCatalog` or `CustomerPreferenceDao`)
 are consistently declared by the type that you use for your `@Autowired`-annotated
-injection points. Otherwise, injection may fail due to a "no type match found" error at runtime.
+injection points. Otherwise, injection may fail due to a "no type match found" error at
+runtime.
 
 For XML-defined beans or component classes found via classpath scanning, the container
 usually knows the concrete type up front. However, for `@Bean` factory methods, you need
 to make sure that the declared return type is sufficiently expressive. For components
 that implement several interfaces or for components potentially referred to by their
-implementation type, consider declaring the most specific return type on your factory
-method (at least as specific as required by the injection points referring to your bean).
+implementation type, declare the most specific return type on your factory method (at
+least as specific as required by the injection points referring to your bean).
 ====
 
 .[[beans-autowired-annotation-self-injection]]Self Injection
@@ -312,8 +313,8 @@ through `@Order` values in combination with `@Primary` on a single bean for each
 ====
 
 Even typed `Map` instances can be autowired as long as the expected key type is `String`.
-The map values contain all beans of the expected type, and the keys contain the
-corresponding bean names, as the following example shows:
+The map values are all beans of the expected type, and the keys are the corresponding
+bean names, as the following example shows:
 
 [tabs]
 ======
@@ -431,7 +432,7 @@ annotated constructor does not have to be public.
 ====
 
 Alternatively, you can express the non-required nature of a particular dependency
-through Java 8's `java.util.Optional`, as the following example shows:
+through Java's `java.util.Optional`, as the following example shows:
 
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
@@ -445,8 +446,8 @@ through Java 8's `java.util.Optional`, as the following example shows:
 ----
 
 You can also use a parameter-level `@Nullable` annotation (of any kind in any package --
-for example, `javax.annotation.Nullable` from JSR-305) or just leverage Kotlin built-in
-null-safety support:
+for example, `org.jspecify.annotations.Nullable` from JSpecify) or just leverage Kotlin's
+built-in null-safety support:
 
 [tabs]
 ======
@@ -477,13 +478,6 @@ Kotlin::
 ----
 ======
 
-[NOTE]
-====
-A type-level `@Nullable` annotation such as from JSpecify is not supported in Spring
-Framework 6.2 yet. You need to upgrade to Spring Framework 7.0 where the framework
-detects type-level annotations and consistently declares JSpecify in its own codebase.
-====
-
 You can also use `@Autowired` for interfaces that are well-known resolvable
 dependencies: `BeanFactory`, `ApplicationContext`, `Environment`, `ResourceLoader`,
 `ApplicationEventPublisher`, and `MessageSource`. These interfaces and their extended
@@ -528,5 +522,6 @@ class MovieRecommender {
 The `@Autowired`, `@Inject`, `@Value`, and `@Resource` annotations are handled by Spring
 `BeanPostProcessor` implementations. This means that you cannot apply these annotations
 within your own `BeanPostProcessor` or `BeanFactoryPostProcessor` types (if any).
+
 These types must be 'wired up' explicitly by using XML or a Spring `@Bean` method.
 ====

spring-web/src/main/java/org/springframework/web/method/support/InvocableHandlerMethod.java

@@ -18,6 +18,7 @@ package org.springframework.web.method.support;
 
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.Objects;
@@ -35,6 +36,7 @@ import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;
 import reactor.core.publisher.SynchronousSink;
 
+import org.springframework.aop.support.AopUtils;
 import org.springframework.context.MessageSource;
 import org.springframework.core.CoroutinesUtils;
 import org.springframework.core.DefaultParameterNameDiscoverer;
@@ -58,6 +60,7 @@ import org.springframework.web.method.HandlerMethod;
  * @author Rossen Stoyanchev
  * @author Juergen Hoeller
  * @author Sebastien Deleuze
+ * @author Yongjun Hong
  * @since 3.1
  */
 public class InvocableHandlerMethod extends HandlerMethod {
@@ -248,6 +251,16 @@ public class InvocableHandlerMethod extends HandlerMethod {
 	 */
 	protected @Nullable Object doInvoke(@Nullable Object... args) throws Exception {
 		Method method = getBridgedMethod();
+		Object bean = getBean();
+
+		if (AopUtils.isCglibProxy(bean) && Modifier.isPrivate(method.getModifiers())) {
+			throw new IllegalStateException(
+					"Cannot invoke private method [" + method.getName() + "] on a CGLIB proxy. " +
+							"Handler methods on proxied components must be public or protected. " +
+							"Change method visibility or use interface-based JDK proxies if applicable."
+			);
+		}
+
 		try {
 			if (KOTLIN_REFLECT_PRESENT && KotlinDetector.isKotlinType(method.getDeclaringClass())) {
 				if (KotlinDetector.isSuspendingFunction(method)) {

spring-web/src/test/java/org/springframework/web/method/support/InvocableHandlerMethodTests.java

@@ -22,6 +22,7 @@ import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.aop.framework.ProxyFactory;
 import org.springframework.core.MethodParameter;
 import org.springframework.web.bind.support.WebDataBinderFactory;
 import org.springframework.web.context.request.NativeWebRequest;
@@ -42,6 +43,7 @@ import static org.assertj.core.api.Assertions.assertThatRuntimeException;
  * Tests for {@link InvocableHandlerMethod}.
  *
  * @author Rossen Stoyanchev
+ * @author Yongjun Hong
  */
 class InvocableHandlerMethodTests {
 
@@ -168,6 +170,21 @@ class InvocableHandlerMethodTests {
 			.withMessageContaining("Illegal argument");
 	}
 
+	@Test
+	void testPrivateMethodOnCglibProxyThrowsException() throws Exception {
+		TestController target = new TestController();
+		ProxyFactory proxyFactory = new ProxyFactory(target);
+		proxyFactory.setProxyTargetClass(true);
+		Object proxy = proxyFactory.getProxy();
+
+		Method privateMethod = TestController.class.getDeclaredMethod("privateMethod");
+		InvocableHandlerMethod handlerMethod = new InvocableHandlerMethod(proxy, privateMethod);
+
+		assertThatIllegalStateException()
+				.isThrownBy(() -> handlerMethod.invokeForRequest(null, null))
+				.withMessageContaining("Cannot invoke private method [privateMethod] on a CGLIB proxy");
+	}
+
 	private InvocableHandlerMethod getInvocable(Class<?>... argTypes) {
 		Method method = ResolvableMethod.on(Handler.class).argTypes(argTypes).resolveMethod();
 		InvocableHandlerMethod handlerMethod = new InvocableHandlerMethod(new Handler(), method);
@@ -216,4 +233,12 @@ class InvocableHandlerMethodTests {
 		}
 	}
 
+	private static class TestController {
+		public TestController() {
+			// Default constructor for proxy creation
+		}
+
+		private void privateMethod() { }
+	}
+
 }